MENU
A small business initially plans to open common communications ports (21, 22, 25, 80, 443) on its firewall to allow broad access to its screened subnet. However, their security consultant advises against this action. Which of the following security principles is the consultant addressing?
Suggested Answer: B
Get Premium SY0-701 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The correct answer is Attack surface because opening multiple common service ports unnecessarily increases the number of potential entry points an attacker can target. In the Security+ SY0-701 exam objectives, the attack surface is defined as the total number of exposed interfaces, services, ports, protocols, and access points that an attacker could attempt to exploit. Each open port corresponds to a listening service, and every exposed service represents an opportunity for reconnaissance, exploitation, or abuse.
In this scenario, the business intends to open ports for FTP, SSH, SMTP, HTTP, and HTTPS without clearly limiting access. While some of these services may be required, opening all of them broadly---especially to a screened subnet---significantly expands the attack surface. If any of these services are misconfigured, unpatched, or vulnerable, attackers could exploit them to gain unauthorized access. The SY0-701 study guide emphasizes minimizing exposed services as a foundational defensive strategy, often referred to as reducing attack surface area.
Option C, least privilege, is related but not the best answer. Least privilege focuses on granting users or systems only the minimum access required, whereas this question specifically concerns exposed network services rather than access rights. Option A, secure access service edge (SASE), is a cloud-based architecture model and is unrelated to basic firewall port exposure decisions. Option D, separation of duties, applies to role and responsibility distribution, not network exposure.
By advising against opening multiple common ports, the consultant is recommending a reduction in exposed services to limit opportunities for attack. This aligns directly with SY0-701 guidance on secure network design, firewall hardening, and minimizing externally accessible services.
In summary, limiting open ports reduces the organization's attack surface, making Attack surface the correct and best answer.
112 comments · newest first
RA
Rajesh Bansal
1 month ago
I think Attack surface is correct tricky part is distinguishing exposed ports from controls.
NI
Nicolas Laurent
1 month ago
Because attack surface is about exposed entry points, not just what you control. The tricky part is that even with safeguards, open ports still widen the attack surface until you restrict or block them.
TA
Tanvi Kapoor
30 days ago
User N: That's true, but the subtle distinction is that exposure is about the services themselves, not just control boundaries; misconfigurations still enlarge the attack surface.
CA
Camille Sokolov
29 days ago
User N: Exactly. The subtle distinction is that exposure concerns the services themselves, not only boundary controls. Misconfigurations or weak defaults on any open port still broaden the attack surface.
MO
Mohit Gupta
30 days ago
User N: Yes, the distinction is exposure versus control. Safeguards help, but they don’t remove exposure; open ports widen the surface until you explicitly restrict or block them.
OL
Olga Bruno
29 days ago
That's true, a subtle distinction is that exposure creates the attack surface, but risk depends on necessity and segmentation, and even limited ports can widen the surface if misconfigured.
VI
Vikram Verma
30 days ago
User N: I was stuck on whether open ports count as exposure or as controls, and clarifying exposed services helped me see the attack surface.
JO
Joshua Phillips
28 days ago
User N: That's true; the subtle distinction is that open ports are exposure points regardless of safeguards, and controls inside don’t reduce the attack surface unless those services are limited.
IN
Ingrid Popov
1 month ago
User N: That's true, but the question targets attack surface not least privilege in network design specifically.
TH
Thomas Clark
30 days ago
User N: You're right that least privilege concerns user rights, but here the focus is exposed services and entry points. Attack surface measures all open ports and services that could be exploited.
RO
Rosa Fedorov
29 days ago
User N: Agree. The scenario focuses on attack surface by exposing services; least privilege would apply to who can access those services, not the port exposure itself.
HE
Henrik Bruno
30 days ago
User O: I also wrestled with B vs C at first, the exposed ports vs access rights part was confusing, but the explanation helped.
CH
Charles Davis
29 days ago
User N: You're right; attack surface focuses on exposed services, not user privileges, but firewall design should also apply least privilege where possible.
HI
Hiroshi Wang
1 month ago
User N: Exactly. Attack surface means exposed services and ports, while least privilege governs access rights; the issue here is the number of reachable entry points, not user permissions.
MA
Matthew Taylor
30 days ago
User N: That's true, I agree. In practice you reduce risk by disabling unnecessary services and closing unused ports to shrink the attack surface.
SE
Seul Liu
1 month ago
Why wouldn't option C apply here since limiting access to services is a control?
RA
Rahul Shukla
28 days ago
User N: That's true, but attack surface is about exposed services not privilege controls. Least privilege governs who can access, not which ports are open.
PR
Priya Mehta
27 days ago
User N: Agree that least privilege targets access rights, but limiting exposed ports reduces the attack surface itself, which is the focus of the scenario.
KH
Khalid Sheikh
29 days ago
Because least privilege focuses on reducing user rights rather than reducing exposed network surfaces, limiting open ports is a defense to shrink the attack surface, which is the core principle addressed.
AN
Andrew Williams
28 days ago
User N: That's a valid point about C, but the distinction is that least privilege targets internal rights, while attack surface focuses on exposed services; reducing ports directly shrinks external risk.
RA
Rajesh Chauhan
30 days ago
I was also confused: is limiting access a control or reducing exposure? The breakdown about exposed ports clarifies attack surface vs controls.
LU
Lucia Andersen
28 days ago
That's true, but the issue here is exposed services, not user permissions, C is related but minimizing open ports best addresses attack surface.
AN
Ankit Agarwal
1 month ago
I was torn between attack surface and least privilege too; the focus on exposed ports helped me see it's about exposure, not rights.
EM
Emi Cho
28 days ago
User 3: I agree, attack surface is the core issue; tightening least privilege still helps reduce potential impact even if some services must stay accessible.
HA
Hassan Ansari
28 days ago
User 4: Agree, and the nuance is that attack surface reduces exposure, while least privilege limits what an attacker can leverage even with access.
IS
Isabella Colombo
1 month ago
User N: You're right that B can reduce rights, but the scenario focuses on exposed entry points. Attack surface counts all listening ports and services; least privilege governs post-access permissions rather than exposure.
TA
Tao Sato
29 days ago
User N: That's true, but a subtle distinction: attack surface counts exposed entry points, while least privilege limits what someone can do after access is gained.
RI
Richard Wright
1 month ago
User N: I also started with attack surface vs least privilege; the tricky part was treating open ports as exposure, not access rights.
IB
Ibrahim Abbasi
29 days ago
User N: That's true, but the distinction is that attack surface concerns exposed services, while least privilege focuses on access rights. Open ports increase exposure regardless of user rights.
IR
Irina Marino
1 month ago
Agree, the tricky part is ports vs controls; limit to required services and monitor exposed interfaces.
KA
Katya Simon
30 days ago
User N: Because attack surface counts exposed services not just who can access them; reducing open ports minimizes entry points, while controls limit user rights elsewhere. The distinction is exposure versus authorization.
AR
Arjun Mehta
29 days ago
User N: Exactly, focusing on exposed ports matters; we should only enable required services and continuously monitor exposed interfaces to detect misconfigurations.
CH
Chiara Volkov
30 days ago
User N: I was torn between A and B too because exposed ports felt separate from controls, realizing this is really about the attack surface clarified it.
KA
Karan Shukla
27 days ago
User N: That fits. The subtle distinction is that attack surface is about exposed services; even essential ports must be tightly controlled and segment access.
SA
Sana Jamil
1 month ago
User N: Exactly, but remember attack surface counts exposed entry points, not just controls. Open only required ports and monitor for misconfigurations or anomalies.
AL
Ali Raza
30 days ago
User N: Exactly. The attack surface is about exposed entry points; open only required ports and add continuous monitoring to catch misconfigurations.
JI
Jian Tanaka
1 month ago
Yep, attack surface covers exposed ports and controls too.
KH
Khadijah Mirza
29 days ago
User N: Exactly, and in practice the emphasis is on reducing exposed services; even with controls, if a service is exposed, it's part of the attack surface.
RO
Robert Baker
28 days ago
User N: That's true, but the key distinction is that attack surface equals exposed services and entry points and controls don't remove exposure, they constrain access.
LI
Linh Zhao
30 days ago
User N: Because attack surface counts exposed entry points like ports and services, not the controls themselves, reducing open ports shrinks the surface while controls mitigate risk but don’t define the surface.
RY
Ryan Wilson
27 days ago
User N: That's true, but reducing exposed ports shrinks the attack surface more than relying on controls alone.
MI
Ming Yoon
1 month ago
I was torn between attack surface and least privilege; the confusing part was whether open ports count as exposure, and explanation about exposed services helped.
KH
Khalid Akhtar
29 days ago
User N: Agree. Attack surface includes exposed ports; least privilege is about who can use them, so both concepts matter for reducing risk.
JA
Jae Suzuki
1 month ago
I see it differently; the focus should be on least privilege rather than attack surface, by granting minimal access to services.
FA
Fang Li
27 days ago
User N: That's true, but least privilege covers access rights; attack surface concerns exposed endpoints, so both must be minimized.
NI
Nisha Dubey
27 days ago
User N: Good point. The subtle distinction is attack surface focuses on exposed endpoints, while least privilege governs what access is actually allowed once those endpoints are reached.
FR
Francesco Ferrari
30 days ago
User N: The key difference is that least privilege limits user rights, while attack surface counts exposed network interfaces and services, opening those ports increases entry points regardless of user permissions.
CH
Charles White
27 days ago
User N: That’s true about least privilege, but attack surface focuses on exposed services; reducing open ports aligns with least privilege by limiting potential entry points.
TH
Thi Bui
30 days ago
User N: I was stuck between C and B too, the exposed ports wording confused me. Attack surface fits because open ports broaden exposure.
CH
Charles Baker
28 days ago
User N: Agree, but note the distinction: attack surface covers exposed services and ports, while least privilege governs what those services can do once accessed.
MA
Matteo Michel
1 month ago
I think Attack surface is correct tricky part is exposed services vs access control.
AN
Anya Morozov
1 month ago
I was stuck between B and C too. The tricky part was distinguishing attack surface from least privilege, and narrowing open ports clarified it.
EM
Emma Evans
28 days ago
User N: Exactly. The subtle distinction is that attack surface concerns exposed services and ports, while least privilege governs who can access them; narrowing open ports reduces exposure.
KE
Kenji Kim
27 days ago
User N: Good point. A subtle distinction: attack surface covers exposed services and ports; least privilege governs who can use them.
PO
Pooja Verma
29 days ago
You're right, B could touch on exposure, but the focus here is exposed services. The point of least privilege is limiting rights, not reducing open ports, so attack surface wins.
SO
Sonal Pillai
27 days ago
User N: You're right, but the subtle distinction is that attack surface covers exposed services and interfaces, while least privilege targets who can use them, not whether they exist.
NE
Neha Iyer
30 days ago
User N: I also found the exposed ports versus access rights confusing. Narrowing to the open service count finally clarified the attack surface.
AL
Ali Hashmi
27 days ago
User N: Exactly, and to add: attack surface is about exposed services and ports, not the permission levels inside; least privilege governs inside access, not external exposure.
KA
Katya Pedersen
1 month ago
Because attack surface is about every exposed entry point, while access control governs who can use them. The scenario concerns open ports increasing exposure even if access is restricted elsewhere.
AN
Anjali Gupta
29 days ago
User N: Exactly, but remember attack surface focuses on exposed services even when access is tightly controlled elsewhere.
KH
Khalid Khan
28 days ago
User N: That aligns with the earlier point. Reducing exposed ports directly shrinks the attack surface even if access controls exist.
MI
Minh Lee
30 days ago
Yeah I was torn between B and C too, the exposed entry points vs access control part was confusing, but the attack surface idea clicked.
RI
Ritu Reddy
29 days ago
Nice catch. The subtle distinction is that attack surface tracks exposed services themselves, while least privilege governs who can use what once exposed.
DA
David Moore
1 month ago
User N: Because the attack surface counts every exposed entry point, not just who can access them. The open ports increase exposure regardless of access controls elsewhere, making surface reduction key.
AL
Alejandro Michel
28 days ago
That's true, but a subtle distinction is that even with access controls, reducing exposed services limits misconfigurations and reconnaissance, complementing, not replacing, least privilege.
WE
Wei Jeong
1 month ago
That's true, but there's a subtle distinction: attack surface concerns exposed services and ports, not just user privileges or roles.
MI
Ming Yang
30 days ago
User 3: You're right, the key distinction is that attack surface tracks exposed services and ports, not user privileges. Minimize surface even when access control seems fine.
AN
Antoine Andersen
28 days ago
User N: Exactly. The practical takeaway is to minimize exposed services and properly configure them to limit potential exploits.
SA
Sanjay Bhat
30 days ago
User N: Yeah, I was torn between B and C at first, mixing attack surface with privileges. The emphasis on exposed ports cleared that up.
AI
Aiko Zhao
28 days ago
User N: Exactly. Attack surface is about exposed ports and services, while least privilege is about restricting user rights instead of port exposure.
AN
Antoine Rodriguez
1 month ago
Because attack surface is about exposed interfaces and ports, not user privileges. The key difference is that open ports create entry points regardless of who logs in.
RA
Rachel Mitchell
30 days ago
User N: That's right, open ports create entry points regardless of credentials, so the focus should be reducing exposed services to shrink the attack surface.
IR
Irina Lopez
1 month ago
I’d argue C least privilege fits better because securing access rights to exposed services reduces risk even if ports remain open.
JE
Jennifer Brown
29 days ago
User N: Good point, but least privilege targets who can access, while here the focus is how many entry points exist, i.e. the attack surface from open ports.
AN
Anjali Iyer
28 days ago
User N: Nice point, but least privilege reduces risk once inside; the issue here is the total number of exposed entry points, the attack surface, which increases with open ports.
SU
Sunita Chopra
30 days ago
User N: Because the issue is the number of exposed entry points, not user rights. Even with least privilege, open ports increase attack surface; reducing exposed services minimizes entry points.
TH
Thomas Collins
28 days ago
User N: Good point, but least privilege limits user rights, not the number of exposed ports; the issue here is reducing the attack surface by limiting exposed services.
PO
Pooja Bhat
30 days ago
I also debated B and C at first; least privilege misled me thinking rights control. The attack surface idea finally clicked.
ST
Stephanie Miller
28 days ago
User N: That's true, but least privilege is about rights; this scenario centers on exposed services and open ports, i.e., the attack surface.
MA
Matteo Esposito
1 month ago
Agree, and note that each open port increases misconfiguration risk if access isn't tightly controlled.
LA
Lars Esposito
30 days ago
User N: Exactly. The distinction is that attack surface counts exposed services; even with tight controls, more open ports create more vectors, so reducing exposed ports lowers overall risk.
ME
Melissa Carter
27 days ago
User N: Good point, but remember the attack surface also grows with misconfig and insecure defaults; reducing ports alone isn't enough without proper hardening and monitoring.
RU
Rupali Mehta
30 days ago
User 3: I agree, and opening ports does raise misconfiguration risk; limiting exposure helps keep the attack surface manageable.
KA
Kazuki Liu
29 days ago
User 4: That's true, but the nuance is that attack surface spans all exposed ports and services, removing unnecessary ones also limits misconfiguration opportunities.
RE
Rebecca Parker
1 month ago
User N: I was also unsure between attack surface and least privilege; the confusing part was deciding which principle the open ports hit, and discussion helped clarify.
MO
Mohit Singh
28 days ago
User N: That misconfiguration risk ties back to attack surface, not least privilege; open ports expand entry points while least privilege governs who can access.
JI
Jiyeon Wu
1 month ago
If the issue is attack surface, why not C least privilege here?
HA
Hafsa Siddiqui
29 days ago
That’s true, but attack surface targets exposed services; least privilege reduces impact after access, not the number of doors an attacker can initially knock on.
PA
Pallavi Rao
27 days ago
User N: Your point about least privilege is valid, but here we’re examining the outer attack surface, not post-connection permissions.
MI
Minhee Kato
1 month ago
Because least privilege governs what authenticated users can do after access, not how many doors are exposed. Here the problem is the number of entry points, the attack surface.
SA
Saad Chaudhry
28 days ago
User N: That's valid, but here the focus is entry points. Least privilege covers post access rights, not how many doors are exposed.
SU
Suresh Kumar
1 month ago
I was torn between C and B too, the confusing part was whether restricting privileges reduces exposed ports or just user access, that explanation helped.
YU
Yuna Kim
27 days ago
User N: That's the subtle point. Least privilege limits who can access resources, not how many ports are exposed; reducing attack surface means closing unnecessary services as well.
DA
David Wilson
1 month ago
Agree, exposed services drive attack surface more than access control.
MA
Matteo Marino
30 days ago
User N: You're right that attack surface grows with exposed services, but the key distinction is access control limits who can use those services, while attack surface counts how many entry points exist to exploit.
TA
Tao Do
27 days ago
User N: That's true, but the subtle point is reducing exposed services lowers attack surface itself, while access control gates who can use those services, and both matter.
MI
Minh Lim
1 month ago
User N: I was torn between focusing on exposed ports or access control, and realizing every open port expands the attack surface helped me.
SA
Samira Aziz
29 days ago
User N: That's true, and we should also restrict who can reach those ports and monitor traffic to keep the attack surface minimized.
HA
Hafsa Mirza
1 month ago
User N: That's true, but attack surface is about exposed interfaces. Even with strong access controls, more open ports mean more vectors to exploit.
LI
Ling Do
29 days ago
User N: I agree with that distinction; attack surface includes more than interfaces, and open ports still expand the surface even with strong access controls.
TE
Tegan
2 months ago
I feel like least privilege also fits. Only open what’s necessary, right?
AL
Albert
2 months ago
Definitely! It’s about minimizing vulnerabilities. More ports mean more chances for attacks.
GA
Garry
2 months ago
I think the consultant is addressing the attack surface. Too many open ports can be risky.
MA
Mabel
2 months ago
Isn't it common to open those ports for business? Sounds normal to me.
FR
Frank
2 months ago
Totally agree with the consultant, too many open ports is a bad idea.
RO
Rodolfo
2 months ago
Wait, why are they opening so many ports? Seems risky!
LI
Linette
3 months ago
I think it's more about least privilege.
KA
Karina
3 months ago
Definitely addressing the attack surface here.
LE
Leota
3 months ago
I feel like separation of duties could be involved too, but it doesn’t seem to fit as well as the other options. I need to think more about this.
DO
Dortha
3 months ago
This question reminds me of a practice scenario we did about firewall configurations. I think the consultant is addressing the attack surface by limiting open ports.
RO
Roxane
3 months ago
I’m not entirely sure, but I think the least privilege principle might apply since opening too many ports could give unnecessary access.
TA
Tammy
4 months ago
I remember studying the concept of attack surface, which relates to the number of points where an attacker could try to enter a system. This seems relevant here.